An AI browser agent can search pages, read information, and sometimes act in your accounts. Before you give it a work task, decide what it can see, where it can go, and which actions need your approval.
Start with one bounded task
A browser agent is more than a search box. Depending on the product and its settings, it can navigate pages, read their contents, fill forms, or click buttons. Its actual access depends on the account, browser session, tool, and permissions you give it.
Start with a task that produces a draft or a summary. Check the result yourself before you give the agent broader authority. Your employer may have rules for approved tools, data, and accounts. Follow those rules first.
Check what the session can reach
A signed-in session may expose more than the page you intend to summarize. Consider open tabs, saved sessions, shared drives, email, and administrative pages. Check the product documentation to learn what its agent can access. Do not assume every AI browser has the same controls.
Use a separate, approved work profile or a limited account when your organization supports one. A separate profile is useful only if its actual permissions are limited. Ask your administrator to remove unnecessary access or provide a test environment. Anthropic recommends isolated environments and minimal privileges for computer use. Read its security guidance.
| Task | A narrower starting point |
|---|---|
| Summarize public vendor pages | Public pages only. Keep work accounts signed out if they are unnecessary. |
| Draft a reply from a shared document | Only the approved document and a draft destination. Review recipients and content yourself. |
| Compare internal records | Only the required records in an approved environment. Confirm whether the tool may process that data. |
Also check where prompts, page contents, screenshots, and outputs go. Ask your IT or security team about retention and sharing settings for the specific service. If the answer is unclear, keep confidential data out of the task until you know.
Keep consequential actions under review
A request to “handle this” can leave too much room for interpretation. Specify whether the agent should only gather information, prepare a draft, or submit a change. Review the exact action before it becomes effective.
Anthropic advises human confirmation for actions with meaningful real-world consequences, including financial transactions and agreements. This is guidance for its computer-use tool, but the review principle is useful when evaluating other agents. See the documented precautions.
Ask for a draft
Request a proposed message, form, purchase, or account change. Tell the agent to stop before submission.
Inspect the details
Check the recipient, destination, amount, attachments, permissions, and any terms. Open the destination independently if something looks unfamiliar.
Approve the specific action
Complete it yourself or use the product’s actual approval control, if available. A prompt asking for approval is not proof that the product enforces a stop.
Payment, sending messages, sharing files, deleting records, changing permissions, and accepting terms deserve particular care. Check whether the product lets you disable actions or require confirmation. If it cannot enforce the boundary you need, do not use it for that task.
Treat page instructions as untrusted
Prompt injection is an attempt to make an AI follow instructions embedded in material it is supposed to read. A page, document, search result, or message may tell the agent to ignore your task, disclose information, or take another action. The instruction can appear legitimate or claim to be a security notice. Anthropic describes this browser risk.
A 2026 research preprint called BrowseSafe++ assembled paired attack and control pages, including injections observed on production sites. The researchers tested detectors and adaptive attacks in a benchmark. Those results show that attacks can be effective in the tested conditions. They do not establish the risk rate for your browser, account, or workplace. Read the research paper.
Do not treat an agent’s assurance that a page is safe as a security control. Review unexpected requests to visit another site, reveal information, install software, or change the task. A useful instruction to the agent is to report such requests and stop, but that instruction alone cannot guarantee compliance.
Put the limits into a task
Suppose you need a comparison of public vendor documentation for a meeting. The following fictional prompt sets a narrow goal and identifies the point where a person takes over. Adapt it to the controls your employer actually provides.
Before starting, verify that the browser session is signed out of unrelated work services. If the product offers site and action restrictions, set them. Afterward, open the cited pages and check the table. The example prompt sets expectations, but it does not replace technical restrictions or your review.
Stop, review, and report unexpected actions
Stop the session
Pause or end the agent task as soon as you notice an unexpected instruction or action. Do not approve another step to make the warning disappear.
Preserve the details
Note the time, page, requested action, and any output or activity history available under company policy. Avoid copying sensitive data into an unsecured report.
Contact the right team
Use your organization’s security or IT reporting channel. Describe what the agent could access and what you observed. Ask for help reviewing account activity and permissions.
If an action actually occurred, its response depends on the account and action. For example, your team may need to review sharing permissions or revoke a session. Do not assume that stopping the agent reverses an action already completed.
Sources and update
Checked November 2, 2026. The research paper is a preprint. Product capabilities and employer policies vary, so check the controls for your own setup.
Frequently asked questions
Can an AI browser read every work account?
Not necessarily. Access depends on the product, session, account permissions, and settings. Check what the specific agent can reach before starting a task.
Does a separate browser profile make an agent safe?
A separate profile can reduce exposure when it has limited access. It is not a guarantee. Check its signed-in accounts, permissions, and available actions.
Is asking the agent to stop before sending enough?
It is a useful instruction, but it may not be enforced. Check whether the product has a confirmation control or technical restriction, and review the action before it happens.
Does prompt injection mean the AI system was hacked?
Prompt injection attempts to redirect the agent through content it reads. It does not by itself establish that an account or underlying system was compromised. Investigate any action or exposure that occurred.